Welcome to ISAserver.org

ISA 2006 Std & Citrix Secure Access Client Dropouts

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 General] >> General >> ISA 2006 Std & Citrix Secure Access Client Dropouts

Page: [1]

Message

<< Older Topic Newer Topic >>

ISA 2006 Std & Citrix Secure Access Client Dropouts - 17.Jul.2008 9:29:16 AM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Hi All,

I'm having a problem with an ISA 2006 Standard that is running as a web proxy with WebSense Enterprise doing the filtering. A number of clients are connecting to an external system using Citrix Secure Access Client, however they are experiencing frequent disconnects. If the client bypasses the ISA proxy these dont occur.

I'm new to ISA and I'm now stuck, any advise would be appreciated...

Thanks,

P

Post #: 1

Featured Links*

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 17.Jul.2008 9:53:24 AM

paulo.oliveira

Posts: 609
Joined: 3.Jan.2008
From: Amazonas, Brazil
Status: offline

Hi P,

I don�t know Citrix. But, monitor your clients access using ISA real-time monitor.

Regards,
Paulo Oliveira.

(in reply to papitts)

Post #: 2

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 17.Jul.2008 10:18:10 AM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Hi Paulo,

Looking in the ISA 2006 sessions monitor it shows the clients sessions with activation of 9am this morning, I guess this means the ISA box doest think the sessions have disconnected? However the user definately experiences dropouts.

Thanks,

Paul

(in reply to paulo.oliveira)

Post #: 3

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 17.Jul.2008 10:50:25 AM

paulo.oliveira

Posts: 609
Joined: 3.Jan.2008
From: Amazonas, Brazil
Status: offline

Hi P,

sorry I was not clear. I meant you have to check the logs from the logging tab. There maybe can give you and idea of what�s going on. See the column Result Code.

Regards,
Paulo Oliveira.

(in reply to papitts)

Post #: 4

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 17.Jul.2008 11:07:58 AM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Hi Paulo,

From looking under monitoring > logging... I'm afraid that I can't see a Result Code column but I can see the following errors occurring for the client; (Just added the result code column).

Failed Connection Attempt 17/07/2008 15:48:06 - No Result Code for this...
Log type: Web Proxy (Forward)
Status: 1460 This operation returned because the timeout period expired.
Rule: Web Access Only
Source: Internal (x.x.x.x)
Destination: External (62.190.95.136:443)
Request: www.office.grainman.co.uk:443
Filter information: Req ID: 06b1f787; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: SSL-tunnel
User: anonymous
Denied Connection 17/07/2008 15:48:07
Log type: Firewall service
Status:

Rule:
Source: Internal (192.168.17.16:1609)
Destination: Local Host (192.168.250.23:8080)
Protocol: HTTP Proxy
User:

Looking under the Rule: Web Access Only, I can't see any timeout configured?

Thanks,

Paul

< Message edited by papitts -- 17.Jul.2008 11:58:48 AM >

(in reply to paulo.oliveira)

Post #: 5

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 18.Jul.2008 9:42:46 AM

tshinder

Posts: 47010
Joined: 10.Jan.2001
From: Texas
Status: offline

Try increasing the timeout value on the firewall for the ISA firewall Network from which the clients are connecting.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to papitts)

Post #: 6

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 18.Jul.2008 3:51:14 PM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Hi Tom,

Thanks for your reply, would you be able to direct me in the right direction for changing this and suggest a value to try?

Cheers,

Paul

(in reply to tshinder)

Post #: 7

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 19.Jul.2008 10:49:38 AM

tshinder

Posts: 47010
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Paul,

You can find this on the Web Proxy tab of the ISA Firewall Network from which the clients are conncting. Then click the Advanced button on that tab.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to papitts)

Post #: 8

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 19.Jul.2008 4:52:31 PM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Thanks Tom, this was currently set to 1800 seconds, I have adjusted this to 2700 seconds will see if this makes a difference to the clients when they are back in the office on Monday.

Cheers,

Paul

(in reply to tshinder)

Post #: 9

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 20.Jul.2008 10:30:44 AM

tshinder

Posts: 47010
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Paul,

Let us know how it works out for you.

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to papitts)

Post #: 10

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 7.Aug.2008 5:27:02 AM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Hi Tom,

It appears that increasing the timeout value hasnt improved matters with the Citrix Secure Access clients.

Any other ideas, suggestions would be appreciated.

Thanks,

Paul

(in reply to tshinder)

Post #: 11

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 8.Aug.2008 9:49:52 AM

tshinder

Posts: 47010
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Paul,

Perhaps the timeout is on their side?

A network monitor trace would help determine if that's the case.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to papitts)

Post #: 12

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 11.Aug.2008 4:39:16 PM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Hi Tom,

If I put the clients through an alternative simple proxy and change nothing else they are able to connect but dont experience the dropouts so indicating that the problem lies with ISA for some reason.

Thanks,

Paul

(in reply to tshinder)

Post #: 13

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 12.Aug.2008 9:18:51 AM

tshinder

Posts: 47010
Joined: 10.Jan.2001
From: Texas
Status: offline

Maybe try configuring the destination site for Direct Access then? In that way, you bypass the firewall's Web Proxy filter for that site.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to papitts)

Post #: 14

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 12.Aug.2008 12:03:36 PM

papitts

Posts: 8
Joined: 17.Jul.2008
Status: offline

Thanks for the response Tom, would you be able to point me in the right direction to set that up?

Cheers,

Paul

(in reply to tshinder)

Post #: 15

RE: ISA 2006 Std & Citrix Secure Access Client Dropouts - 13.Aug.2008 9:38:32 AM

tshinder

Posts: 47010
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Paul,

Give this a try:

http://isaserver.org/articles/2004directaccessp1.html

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to papitts)

Post #: 16